Brussels seals EU-Switzerland passenger name record deal to fight terrorism

The Council of the European Union concluded on 1 October 2026 the agreement with the Swiss Confederation on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, after the European Parliament gave its consent on 16 September 2026. The approval is formalised in Council Decision (EU) 2026/2360, while the full text of the treaty is published as 2026/2361. Both appear in the Official Journal of the European Union, L series, of 26 October 2026.

The agreement had been signed on 5 March 2026 under Council Decision (EU) 2026/643 of 23 February 2026, subject to conclusion at a later date. The Council acted on the basis of Article 16(2) and Article 87(2), point (a), of the Treaty on the Functioning of the European Union, read in conjunction with Article 218(6), second subparagraph, point (a). The European Data Protection Supervisor was consulted under Regulation (EU) 2018/1725 and delivered its opinion on 19 December 2025.

A push-only channel for airlines

The treaty obliges Switzerland to ensure that air carriers transmit PNR data to the Swiss Passenger Information Unit exclusively by the “push method”, feeding the requesting authority’s database directly rather than allowing it to pull data from airline systems. Carriers may transfer data on a scheduled basis starting no earlier than 48 hours before scheduled departure, and a maximum of five times for a specific flight, limited to updates if Switzerland so permits.

The scope covers air carriers operating passenger flights between the Union and Switzerland, as well as carriers incorporated, or storing data, in the Union and flying to or from Switzerland. Switzerland may not demand data elements that carriers do not already hold for reservation purposes, and must delete on receipt any element not listed in the annex, which exhaustively sets out 19 categories:

• PNR record locator, date of reservation or ticket issue, and intended travel dates
• Passenger names, address, telephone and email contact details
• Payment and billing information for the ticket, and complete travel itinerary
• Frequent flyer status and number, travel agency data, and seat and baggage information
• Travel status, split PNR data, code share information and unaccompanied minor details
• Any advance passenger information already collected, plus all historical changes to the record

The parties may also agree that Switzerland uses the API-PNR router set up under Regulation (EU) 2025/13; if the Union amends that regulation, Switzerland has 120 days to notify its intention to stop using the router.

Five years of storage, six months before anonymisation

PNR data may be processed strictly to prevent, detect, investigate and prosecute terrorist offences or serious crime, defined as offences punishable by at least three years of custody under Swiss law with an objective link to air carriage. Storage is capped at five years, and the Swiss PIU must depersonalise records at the latest six months after receipt by masking names, contact details, payment information, frequent flyer data and free-text remarks.

Processing of data revealing racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sex life or sexual orientation is prohibited, and such data must be deleted immediately. Positive matches from pre-determined criteria must be reviewed individually by non-automated means, and disclosure to Swiss authorities requires approval by a judicial or other independent body, except in duly justified urgency.

Europol, Eurojust and the Schengen gap

The agreement is designed to foster police and judicial cooperation between Swiss authorities, those of the Member States, Europol and Eurojust, with the stated aim of ensuring internal security in the absence of internal border controls in the Schengen area. The Swiss PIU and the PIUs of the Member States must share PNR data, processing results and analytical information as soon as possible where necessary, on their own initiative or on request.

Disclosure to countries outside the Union and Switzerland is conditional on that country having concluded an agreement with the Union or benefiting from an adequacy decision by the European Commission, plus prior approval by a judicial or independent body. Switzerland must apply the same rights and obligations as those in Directive (EU) 2016/680, with oversight by an independent supervisory authority, and must publish on its website the legislation authorising the transfers, the reasons for collection and the contact point for inquiries.

Entry into force and reversibility

Under Article 19, the agreement enters into force on the first day of the month following the later of two notifications: Switzerland’s notification of its designated authorities, or the parties’ confirmation that their internal procedures are complete. Either party may suspend application with two months’ notice after consultation, or terminate with three months’ notice, and Switzerland must continue applying the terms to data received beforehand.

Ireland notified its wish to take part by letter of 9 February 2026 under Protocol No 21; Denmark is not bound by the decision under Protocol No 22. The joint declaration attached to the treaty recalls that the Swiss Air Passenger Data Act of 21 March 2025 is the domestic basis for transfers by Swiss carriers.

The decision matters beyond Brussels and Bern: it gives European airlines a single legal channel for handing over passenger records on Swiss routes, while fixing the retention clock, the anonymisation deadline and the judicial filter that travellers and data protection authorities can hold Switzerland to. Because the treaty is reversible on short notice and subject to joint evaluation, its practical weight will depend on how the Swiss PIU applies the criteria and how strictly the independent supervisor polices them.

Source: Official Journal of the European Union, L series, 26 October 2026, 2026/2360 and 2026/2361 (official reference: Council Decision (EU) 2026/2360; Agreement 2026/2361).